Privacy Policy

Last updated: September 2026

This Privacy Policy explains what personal information CLASO ("we", "us", "our") collects through nextclasso.vercel.app (the "Site"), why we collect it, how it is stored, and the choices and rights you have. It is written to comply with Pakistan's applicable legal framework, including the Electronic Transactions Ordinance, 2002 (which gives electronic records and communications legal recognition), the Prevention of Electronic Crimes Act, 2016 ("PECA"), and applicable provincial Consumer Protection laws. Pakistan does not yet have a single, dedicated data protection statute in force (a Personal Data Protection Bill has been under consideration), so we also follow internationally recognised good-practice standards for handling customer data.

1. Information we collect

• Order & contact information: your name, phone number, delivery address, and the items you order, collected when you check out.
• Communications: messages you send us (e.g. by phone or WhatsApp) to confirm or discuss an order.
• Admin accounts: store staff who manage products and orders authenticate with their own credentials via Supabase Auth; we do not store admin passwords in plain text.
• Technical & usage data: standard data such as IP address, browser/device type, and pages visited, collected automatically by our hosting provider (Vercel) for security, abuse-prevention, and performance purposes.
• Abuse-prevention data: when you place an order or send us a review, we record the IP address the request came from and a random identifier stored in your browser (see section 9). These are used only to detect and stop spam, fake orders and other abuse — never for advertising, profiling or cross-site tracking.
• Review content: if you leave a review, we store the name and city you enter, your rating and text, plus the IP address the submission came from, so we can keep spam and fake reviews off the Site. Reviews are only published after a member of our team approves them.
• Cart/session data: stored locally in your browser so your cart persists between visits on the same device.

We do not collect payment card, bank, or wallet details through the Site. CLASO currently operates on a cash-on-delivery (COD) basis, so no financial account information passes through or is stored by the Site.

2. Why we collect it (purpose & legal basis)

• To process, confirm, and deliver your order — the core purpose for which the data is provided to us.
• To contact you about an order, including manual confirmation calls in place of automated OTP verification.
• To detect, prevent, and investigate fraud, abuse, or security incidents.
• To keep records required for accounting, tax, and dispute-handling purposes.
• To maintain and improve the Site's performance and reliability.

We collect only what is reasonably necessary for these purposes, and we do not use your order data for unrelated advertising or sell it to third parties.

3. Who we share information with

Your information is shared only where necessary to run the business, specifically with:

• Delivery/courier partners — your name, phone number, and address, solely to deliver your order.
• Infrastructure providers — Supabase (database and file storage) and Vercel (hosting), who process data on our behalf under their own security and data-processing terms. These providers may store or process data on servers located outside Pakistan; by using the Site you consent to this cross-border processing, which is used only to operate the Site and never sold onward.
• Legal & regulatory authorities — where required by Pakistani law, court order, or a lawful request from an authority such as the Federal Investigation Agency's Cybercrime wing under PECA.

We do not share your personal data with third parties for their own marketing purposes.

4. Order confirmation without OTP

Orders are confirmed manually by our team, typically by phone, rather than through an automated OTP/SMS verification step. Your phone number is used solely for order confirmation and delivery coordination, and is not used to send marketing messages unless you separately opt in.

5. Data storage & security

Order and product data is stored with Supabase, protected by row-level security (RLS) policies so that only authenticated, authorized admin accounts can access order records. Admin accounts must complete a second authentication step (a time-based code from an authenticator app) before the database will return any customer data. Product images are stored in Supabase Storage. Our Site also applies standard security headers (e.g. against clickjacking and content-type sniffing) at the infrastructure level. While we take reasonable technical and organizational measures to protect your data, no method of transmission or storage over the internet can be guaranteed 100% secure. If we become aware of a data breach that poses a real risk to you, we will take reasonable steps to notify affected customers and address it without undue delay.

6. Data retention

We retain order and customer records for as long as reasonably needed to fulfil orders, handle returns, warranty, or disputes, and to meet tax and recordkeeping obligations under Pakistani law. When data is no longer needed for these purposes, we take reasonable steps to delete or anonymize it. In practice:

• Orders: kept while the order, any return or warranty period, and our accounting records require it, then deleted or reduced to anonymized totals.
• Abuse-prevention data (IP address, browser identifier): kept for a maximum of 12 months and then deleted. It is never used to build a profile of your shopping.
• Reviews: published reviews are kept while they are shown on the Site. The IP address attached to a review is removed once it is no longer needed to detect repeat spam.
• Newsletter: kept until you ask to be removed.

7. Your rights & choices

You may contact us at any time to:

• Ask what personal information we hold about you
• Ask us to correct inaccurate information
• Ask us to delete your information, subject to any legal or accounting retention requirements
• Withdraw consent to non-essential communications (e.g. opt out of promotional messages)

We will respond to any such request as soon as reasonably possible.

8. Children's privacy

The Site is intended for use by adults capable of entering into a binding contract under Pakistani law. We do not knowingly collect personal information from children. If you believe a minor has provided us with personal information, please contact us so we can remove it.

9. Cookies & local storage

The Site may use basic cookies or browser local storage to keep your cart contents between visits. These are strictly functional — we do not currently use third-party advertising or cross-site tracking cookies.

Alongside your cart, your browser stores a random device identifier(a value generated by the Site, for example 3f9c…). It is not a fingerprint: it is not derived from your screen, fonts, or any other characteristic of your device, and it is not shared with anyone. We use it for one purpose — to limit how many orders a single device can place from the same connection, which is how fake cash-on-delivery orders are usually generated. Clearing your browser data replaces it, and the Site still works normally without it.

10. International visitors

The Site is operated for customers in Pakistan. If you access the Site from outside Pakistan, you do so on your own initiative and are responsible for compliance with any local laws that may apply to you.

11. Changes to this policy

We may update this Privacy Policy from time to time, including to reflect changes in Pakistani law (such as any future data protection legislation). Changes will be posted on this page with an updated "Last updated" date, and continued use of the Site after changes are posted means you accept the updated policy.

12. Governing law

This Privacy Policy is governed by the laws of the Islamic Republic of Pakistan.

13. Contact us

Questions about this policy, or to exercise any of the rights above, contact us at support@claso.pk [replace with your real support email/phone].